Vulnerabilities > CVE-2017-8850 - Cleartext Transmission of Sensitive Information vulnerability in Oneplus Oxygenos
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 | |
| Hardware | 5 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Session Sidejacking Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Harvesting Usernames or UserIDs via Application API Event Monitoring An attacker hosts an event within an application framework and then monitors the data exchanged during the course of the event for the purpose of harvesting any important data leaked during the transactions. One example could be harvesting lists of usernames or userIDs for the purpose of sending spam messages to those users. One example of this type of attack involves the attacker creating an event within the sub-application. Assume the attacker hosts a "virtual sale" of rare items. As other users enter the event, the attacker records via MITM proxy the user_ids and usernames of everyone who attends. The attacker would then be able to spam those users within the application using an automated script.
- Signature Spoofing by Mixing Signed and Unsigned Content An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.
- Passively Sniff and Capture Application Code Bound for Authorized Client Attackers can capture application code bound for the client and can use it, as-is or through reverse-engineering, to glean sensitive information or exploit the trust relationship between the client and server. Such code may belong to a dynamic update to the client, a patch being applied to a client component or any such interaction where the client is authorized to communicate with the server.
Seebug
bulletinFamily exploit description #### Summary The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. #### Technical Details OxygenOS & HydrogenOS send the following JSON request to `http://otac.h2os.com/post/Query_Update` or to `http://i.ota.coloros.com/post/Query_Update` in order to check if a new OTA is available: ``` { "beta": "0", "imei": "<IMEI>", "isOnePlus": "1", "language": "en", "mobile": "ONEPLUS A3010", "mode": "0", "ota_version": "<CURRENT_VERSION>", "type": "1", "version": "1" } ``` For example, on a OnePlus 3T device running OxygenOS 4.1.1 this results in the following response, announcing that a 4.1.3 OTA is available: ``` { "active_url": "http://otafsc1.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "description": "https://otafsc.h2os.com/html/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011_version_EN_1492072442240.html", "down_url": "http://otafsc.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "extract": "#OS Version: OnePlus3TOxygen_28_170411\n##WHAT'S NEW\n\\\n\u2022 Upgraded Android 7.1.1 \n\\\n\u2022 Added expanded screenshots \n\\\n\u2022 Improved picture taking of moving objects\n with blur reduction \n\\\n\u2022 Improved video stability when recording\n\\\n\u2022 Improved WiFI connectivity \u00a0\n\\\n\u2022 Improved bluetooth connectivity \n\\\n\u2022 Fixed Instagram swiping bug\n\\\n\u2022 Fixed hardware buttons\u00a0malfunction\u00a0bug\n\\\n\u2022 Increased system stability\n\\\n\u2022 General bug fixes\n [www.oneplus.net](http://www.oneplus.net/)", "new_version": "OnePlus3TOxygen_28.A.51_GLO_051_1704112011", "patchFilePath": "/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_md5": "031507863135b7008c2651ea461d0e9e", "patch_name": "OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_size": "1461187808", "recommend": "100", "share": "\u8bf7\u7528\u82f1\u8bed\u8bbe\u7f6e\u5206\u4eab\u5185\u5bb9", "type": "1", "version_name": "OnePlus3TOxygen_28_1704112011", "wipe": "0" } ``` Man-in-the-Middle attackers can therefore spoof this response in order to exploit CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. ### POC `https://github.com/alephsecurity/research/tree/master/OnePlusOTA` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2016-10370 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017022. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported. id SSV:93109 last seen 2017-11-19 modified 2017-05-12 published 2017-05-12 reporter Root title OnePlus OTA Lack of TLS Vulnerability(CVE-2016-10370) bulletinFamily exploit description #### Products * OnePlus 3T * OnePlus 3 * OnePlus 2 * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script in the OnePlus OTA images (see below), and the fact both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA (on OnePlus 3/3T ‘Secure Start-up’ must be off). updater-script of the OnePlus 3T OxygenOS 4.1.3 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` updater-script of the OnePlus 3T HydrogenOS 3.0.0 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8850 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017020. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported. id SSV:93107 last seen 2017-11-19 modified 2017-05-12 published 2017-05-12 reporter Root title OnePlus OTA OxygenOS/HydrogenOS Crossover Vulnerability(CVE-2017-8850)
The Hacker News
| id | THN:51F38064616715ED3D71C32EC64BFB0F |
| last seen | 2018-01-27 |
| modified | 2017-05-12 |
| published | 2017-05-11 |
| reporter | Swati Khandelwal |
| source | https://thehackernews.com/2017/05/oneplus-mobile-vulnerabilities.html |
| title | All OnePlus Devices Vulnerable to Remote Attacks Due to 4 Unpatched Flaws |